How Certificate System Works
38
Red Hat Certificate System Administrator’s Guide • September 2005
•
Administrative Interface—The administrative interface is a java application, called
Red Hat Console, that provides a GUI interface for performing administrative tasks and
configuring plug-in modules and instances of plug-in modules. The area of Red Hat
Console that is specific to CS tasks is called the CS console. This interface is similar
for all four subsystem. It contains some common configurable features, but also
contains different plug-in types that can be configured depending on the kind of
subsystem installed. The administrative interface is configured for user ID and
password authentication. You can configure it for SSL authentication.
•
Agent Services Interface—The agent services interface is a customizable HTML
interface that can be used to perform agent tasks, such as editing and approving
requests for certificate approval, certificate renewal, and certificate revocation. The
agent services interface is almost identical for a Certificate Manager and a Registration
Manager. The agent services interface for a Data Recovery Manager and an Online
Certificate Status Manager are specific to those subsystem.
•
End-Entity Services Interface—The end-entity interface is a customizable HTML
interface that can be used for end-entities to enroll in your PKI, renew certificates,
revoke their own certificates, and pick up issued certificates. It contains forms for
different types of enrollments, and for the enrollment different types of end-entities.
The Certificate Manager and the Registration Manager have an end-entity services
interface, the Data Recovery Manager and OSCP Manager do not.
Logs
Each subsystem produces extensive system and error logs that record various events and
system errors so that you can monitor and debug the system. All log records are stored in
your local file system for quick and easy retrieval.
CS allows you to sign log files digitally before archiving them or distributing them for audit
purposes. This feature enables you to check whether the log files were tampered with after
being signed.
The log feature is configurable, allowing you to select logging levels as well as what is
logged. You can also create custom logs so that events can be separated by the categories
you choose. See “Logs,” on page 255 for complete details.
Auditing
CS maintains audit trails for all events—certificate requests and issuance, revocation
requests, CRL publication, and so on. These audit records enable you to detect any
unauthorized access or activity.
CS allows you to set up special users called Auditors who have exclusive access to these
logs, allowing independent auditing of your PKI.
Summary of Contents for CERTIFICATE 7.1 ADMINISTRATOR
Page 1: ...Administrator s Guide Red Hat Certificate System Version7 1 September 2005 ...
Page 22: ...22 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 128: ...Cloning a CA 128 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 368: ...ACL Reference 368 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 460: ...Constraints Reference 460 Red Hat Certificate System Administrator s Guide September 2005 ...
Page 592: ...CRL Extension Reference 592 Red Hat Certificate System Administrator s Guide September 2005 ...
